Basic information about privacy

1. Data controller

Company name: Maes and Partners SL

Tax ID (CIF): B93007961

Address: Calle Aduar 25, Bajo, 29601 Marbella (Málaga), España

Phone: +34 604 425 693

Email: contact@marbellavillage.es

Website: www.marbellavillage.es

2. Personal data we collect

Depending on the service requested, we may collect the following categories of data:

• Identification data: full name, passport/ID number (where legally required for tourist accommodation registration).
• Contact data: email address, phone number, postal address.
• Booking data: check-in/check-out dates, number of guests, accommodation preferences.
• Payment data: credit/debit card details, processed securely via certified payment gateways. We do not store payment data on our servers.
• Browsing data: IP address, browser type, pages visited, collected via analytical cookies (see Cookie Policy).
• Communications: messages sent via the contact form, email, or WhatsApp.

3. Purposes and legal bases for processing

We process your data for the following purposes and on the following legal bases:

• Reservation management and provision of accommodation services — Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Compliance with the legal obligation to register travellers with the authorities (Spanish National Police / Civil Guard) — Legal basis: legal obligation (Art. 6(1)(c) GDPR), pursuant to Royal Decree 933/2021.
• Invoicing and accounting — Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending commercial communications and newsletters — Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time.
• Website improvement through statistical analysis — Legal basis: legitimate interest (Art. 6(1)(f) GDPR), where data are anonymised or pseudonymised.
• Handling enquiries and complaints — Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Data retention periods

• Booking and guest data: for the duration of the contractual relationship and, thereafter, for applicable statutory limitation periods (generally 5 years under civil law; 4 years under tax law in Spain).
• Traveller registration records: in accordance with applicable public security regulations (currently 3 years).
• Commercial communications: until consent is withdrawn or erasure is requested.
• Browsing data (analytical cookies): as set out in the Cookie Policy.

5. Recipients of personal data

Your personal data will not be sold or transferred to third parties for commercial purposes. Data may be shared with:

• Law enforcement authorities: in fulfilment of the legal obligation to register travellers.
• Travel agencies and booking platforms (Airbnb, Booking.com, Vrbo, etc.): where a booking was made through such a platform, each acts as an independent data controller.
• Technology service providers: property management software (Avantio), payment gateways, email and web analytics services, acting as data processors under contract.
• Public authorities: where legally required.

6. International data transfers

Some of our technology providers (Google Analytics, payment platforms) may transfer data to countries outside the European Economic Area. In such cases, transfers are covered by appropriate safeguards under the GDPR (adequacy decisions, standard contractual clauses, or other mechanisms).

7. Data subject rights

You have the right to:

• Access: request confirmation of whether we process your personal data and obtain a copy.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure ('right to be forgotten'): request deletion of your data when it is no longer necessary for the purposes collected.
• Restriction of processing: request that we suspend processing in certain circumstances.
• Data portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest or for direct marketing purposes.
• Withdrawal of consent: at any time, without retroactive effect, where processing is based on consent.

To exercise your rights, please contact us in writing at: contact@marbellavillage.es or Calle Aduar 25, Bajo, 29601 Marbella (Málaga), España, stating your name, a copy of your identity document, and the right you wish to exercise. We will respond within one month (extendable to two months in complex cases). You also have the right to lodge a complaint with the Spanish Data Protection Authority (www.aepd.es) or the supervisory authority in your country of residence.

8. Security measures

Maes and Partners SL has implemented the technical and organisational measures necessary to ensure the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data stored, and the risks to which they are exposed.

9. Minors

Our services are not directed at children under the age of 14. We do not knowingly collect data from minors without parental or guardian consent. If you become aware that a minor has provided data without such consent, please contact us so that we may delete it.

10. Amendments

Maes and Partners SL reserves the right to amend this Privacy Policy to reflect legislative, judicial, or business practice changes. Last updated: Mayo 2026.